The hacker laundered $333 million in a week, $208 million of it in the first two and a half days. On TRON, it moved faster than the thieves who robbed Bybit
Seven days, nine blockchains, $6.3 billion in stolen coins. We followed every one of them to see how much got away, and how fast.
- $333M
- $208M
- 82%
- $57M
- $113M
- $2.8B
01 · What happenedA week after the Binance hack, where did the money go?
A hacker took $6.3 billion from Binance on 29 October. Within two and a half days, it had moved $208 million of it out of reach. By the end of the week, $333 million was gone.
Speed matters after a crypto theft. Once stolen coins leave the chain they were taken on, freezes and blacklists rarely reach them. In February 2025, the thieves who robbed Bybit got 56% of their haul out of reach in seven and a half days.
Bitquery records every transfer on the blockchains involved. So we followed every coin the hacker took, on all nine chains, up to 10:00 UTC on 6 November. Our first report on the Binance hack explains how the theft happened. This one tracks the money since.
The $333 million is 10% of the $3.5 billion that was not frozen. On TRON it laundered 84% of its coins, most of it in the first two and a half days, faster than Bybit's thieves did. The $2.8 billion in bitcoin and in value stolen on Ethereum has not left its chain.
Our count has limits. About $71 million went to wallets we did not follow, and a few calls about who owns which wallets could move the total by about 5%.
02 · The basicsHow stolen crypto gets laundered
A thief who steals crypto has a problem. Every coin sits on a public ledger, and every move leaves a record anyone can read. Token issuers can freeze some coins, too. Tether and Circle, the companies behind the dollar tokens USDT and USDC, can lock their tokens in any wallet.
So thieves try to move coins where the freeze cannot reach and the trail is harder to follow. The usual way is to swap them for coins on another chain. THORChain, a network that swaps coins between blockchains without user accounts, takes in TRX or XRP on one chain and pays out bitcoin or ether on another. A bridge does the same job for a single token. A mixer pools many deposits so that nobody can match a withdrawal to the deposit behind it.
Here, a coin counts as laundered once it leaves the chain it was stolen on, goes into a mixer, or reaches an exchange. A coin swapped for another coin on the same chain still counts as held. We value every coin at its price at the moment it was stolen, so the totals do not swing with the market.
03 · The pace$208 million in two and a half days
The hacker moved fastest at the start. By the morning of 1 November, two and a half days after the theft, it had laundered $208 million, most of the week's total and almost all of it TRON coins. On 31 October alone, at least $146 million went.
Measured against what it could move, TRON went fastest of all. By that morning, 82% of the unfrozen TRON value was gone. Most of it went through THORChain and Relay, another cross-chain swap service.
Solana came next. Most of the Solana money left on 3 and 4 November, through Circle's bridge and a mixer called Privacy Cash. XRP came last. The hacker sent its first XRP into THORChain on the afternoon of 5 November and laundered $57 million in the 19 hours before our cut-off. Bitquery sells the full TRON, Solana and XRP histories as files.
The Bybit hack of February 2025 is the obvious comparison. The thieves there took about $1.46 billion in ETH, all of it on Ethereum. By the count of EmberCN, an analyst who tracks hacks on-chain, they had laundered 27% after four and a half days and 56% after seven and a half. Taylor Monahan, a security researcher at MetaMask, told The Block that they had moved at least 209,384 ETH onto Bitcoin after six and a half days. That is 42% of the total, by our division.
| Days after the theft | Bybit, 2025 | Binance, all chains | Binance, TRON |
|---|---|---|---|
| 4.5 | 27% laundered (EmberCN) | 6% | 83% |
| 6.5 | at least 42% moved onto Bitcoin (Monahan, via The Block) | 8% | 84% |
| 7.5 | 56% laundered (EmberCN) | 9% | 84% |
Across all its unfrozen coins, the Binance hacker was slower. At the same points it had laundered at least 6%, 8% and 9%. The gap comes from the BTC and ETH it never touched. On TRON, it beat Bybit's thieves by days.
04 · The splitThe bitcoin and ether stayed put
Freezes and rescues took $2.8 billion out of the hacker's reach. That left $3.5 billion unfrozen. Of that, 81% sat on Bitcoin or came from Ethereum, and none of it was laundered by the cut-off.
The bitcoin taken from Binance's Bitcoin hot wallet, the online wallet an exchange pays customers from, still sits in the addresses that first received it. On Ethereum, 94% of the hacker's ETH sits in a handful of wallets that have never sent a transaction. Almost nothing stolen on Ethereum left that chain, only some gas money for wallets on other chains. Bitquery also sells the full history of both chains as files, in the Bitcoin dataset and the Ethereum dataset.
On the smaller chains, the hacker moved most of the money. It laundered 84% of the TRON coins it could move and 65% of the Solana coins. On XRP, it had laundered 19% by the cut-off, all of it on the last day.
05 · The moneyWhere the $6.3 billion sits now
Token issuers, and the security council that runs the Arbitrum chain, froze or rescued $2.8 billion. Stablecoins, the dollar tokens, make up 94% of it. That is $92.5 million more than our first report counted. The largest piece is wBETH, Binance's own staked-ETH token, which Binance blacklisted in the hacker's wallet on the night of the theft.
| Missed in our first count | Value |
|---|---|
| 29,934 wBETH | $74.7 million |
| Moved back by issuers | $10.1 million |
| 11 smaller freezes | $7.7 million |
| Total | $92.5 million |
The hacker still holds $3.1 billion, less than the $3.2 billion our first report counted on 5 November. Since that read, it has swapped 44.2 million XRP. And this count books bitcoin and ether bought with TRON and Solana coins as laundered, where the first report counted them as held. The same goes for the loan the hacker took on Aave, a lending app: we count the stolen USDT behind it, the first report the ETH borrowed against it.
Most of the ETH in those wallets was never stolen as ETH. Only 36% of it came out of Binance as ether. The hacker bought most of the rest with stolen stablecoins and tokens in the first hours, losing money on many of those trades. It borrowed some on Aave, and some came in from its TRON swaps.
About $71 million left our view, almost all of it on TRON and Solana. That money went on to wallets we did not follow, or into wallets that also held money from other sources.
06 · The routesTHORChain carried the most
THORChain took $113 million, split almost evenly between XRP and TRON. The rest went through other cross-chain swap services, such as Relay, Chainflip and Symbiosis, and through CCTP, Circle's own bridge for USDC. THORChain paused swaps on 31 October and reopened late on 3 November, according to Elliptic. Our count of the TRX that THORChain kept matches the tally SomaXBT, an on-chain analyst, posted on 1 November, within 1%.
Relay took $56 million, almost all of it from TRON on 31 October. The USDT we count into Relay, after refunds, is within 1% of SomaXBT's figure. CCTP carried $53 million out of Solana. The hacker sold SOL for USDC, destroyed the USDC on Solana, and had Circle issue the same amount again on Ethereum and Avalanche.
A further $35 million went through a swap contract named BWSwapRouterV1. The USDT it produced landed in a busy hub wallet that also pays a Bitget deposit address, an address the exchange gives to one customer. Our report on the Ledger and CryptoBilis theft found the same hub taking stolen USDT in October. We count this money as cashed out, because it left the hacker's wallets for a service.
Chainflip took $24 million and Symbiosis $23 million. SomaXBT counted more for Chainflip. Its figure comes within 5% of ours only if we add 9 million USDT of deposits that we could not tie to the hacker. Adding them would raise our total by about $10 million.
On Solana, the hacker put about $7.7 million into Privacy Cash, the mixer, on 3 and 4 November. Our 5 November report said none of the money had reached a mixer. It missed these deposits. HitBTC, an exchange, received $4.4 million through deposit addresses that its own hot wallet swept.
07 · The end pointFour routes, one set of Bitcoin wallets
Many of these routes end in the same place. By the cut-off, the XRP swaps had paid 620 BTC to 28 Bitcoin addresses. Swaps of ETH, AVAX and TRX paid the same addresses too.
The ETH came from the hacker's TRON and Solana swaps, and part of it started as Solana money. The hacker bought the AVAX with USDC that left Solana through Circle's bridge. So routes that look separate on each blockchain lead to one set of Bitcoin wallets. Those wallets, and the BTC and ETH that have not left their chains, are the places to watch. Anyone can follow them with the Bitquery MCP.
08 · The methodHow we counted
We started from every wallet that received money from Binance's hot wallets on 29 October, on all nine chains. We followed each coin until it left its blockchain, went into a mixer, reached an exchange, or stopped. Each coin counts once, at its first exit. Where a wallet mixed the hacker's money with other money, we counted only the hacker's share.
The pace chart uses the time of each exit. For 70% of the value we have the exact time. For the rest we have a time window, and the shaded band on the chart covers it. The band is never wider than $25 million, under 1% of the unfrozen total.
The Bybit comparison mixes two measures. EmberCN and Lookonchain count ETH that left the thieves' wallets. Monahan and Bybit's CEO, Ben Zhou, count ETH turned into bitcoin. Our own count sits between the two. Wallet attributions come from our own labels and the wallets' behaviour. Bitquery also sells its address labels as an API.
The count runs from 20:04 UTC on 29 October to 10:00 UTC on 6 November. Coins that moved after the cut-off are not included; the hacker was still swapping XRP when it came.
Values are theft-time prices. A coin counts once, at the first time it leaves its chain, enters a mixer or reaches an exchange. Later hops of the same money are not counted again.
Where a wallet held the hacker's money mixed with other money, only the hacker's share counts. Three ownership calls move the laundered total between $315 million and $344 million. Another $71 million went to wallets we did not follow.
70% of the value has an exact exit time. For the rest, the pace chart shows a band that covers the known time window.
The Bybit points come from other analysts and measure slightly different things: ETH that left the thieves' wallets, or ETH turned into bitcoin. They are not counted the way we count Binance.
Wallet attributions come from Bitquery's own labels and from each wallet's behaviour. A wallet can be mislabelled, and labels may change as more data comes in.
09 · The recordThe addresses behind the laundering
Follow stolen money across chains in plain English
Every transfer in this story comes from Bitquery's blockchain data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask where a wallet sent its coins, which swap service it used, or which labels an address carries, without writing a query. The full history is also sold as files on the Bitquery Data Store, including the TRON dataset, the Solana dataset, the XRP dataset, the Bitcoin dataset and the Ethereum dataset.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell or hold any token or asset, or to use or avoid any exchange, wallet, protocol or service.
The findings describe transfers observed on Ethereum, Bitcoin, TRON, XRP Ledger, Solana, Arbitrum, Polygon, Optimism, Base and Avalanche between 29 October and 6 November 2026. Attributions come from address labels and from on-chain behaviour; they may be incomplete or incorrect and may be revised as more data becomes available.
References to Binance, Bybit, Bitget, HitBTC, THORChain, Relay, Circle, Tether, Chainflip, Symbiosis, Across, USDT0, deBridge, Privacy Cash, Aave, Ledger, CryptoBilis, MetaMask, SomaXBT, EmberCN, Lookonchain, Elliptic, The Block or any other named project, company, person or service describe what the public record shows about addresses and transactions linked to them. They are not statements about any party's intent or conduct, and nothing here asserts that any named party acted unlawfully or knew the funds were stolen.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.
FAQ
How much of the Binance hack money has been laundered?
By the cut-off on 6 November, the hacker had laundered or cashed out $333 million, 10% of the money that was not frozen. Another $71 million went to wallets we did not follow.
Is the Binance hacker laundering faster than the Bybit hackers did?
On TRON, yes. The hacker laundered 82% of its TRON coins within two and a half days, while Bybit's thieves had laundered 27% of their ETH after four and a half. Across all its unfrozen coins, the Binance hacker is slower, because it has not touched its bitcoin or ether.
Why hasn't the Binance hacker moved the bitcoin and ether?
The blockchain data does not say why. It shows that the stolen bitcoin sits unspent in the addresses that received it, and that most of the hacker's ETH sits in wallets that have never sent a transaction. All the laundering so far moved coins stolen on TRON, Solana, XRP and Base.
What is THORChain, and why do hackers use it?
THORChain is a network that swaps coins between blockchains, for example XRP for bitcoin. It has no user accounts, so no one can freeze a user there. It carried $113 million of the hacker's money, more than any other route.
How does crypto money laundering work in a hack like this?
The thief swaps stolen coins for coins on another blockchain, often through a cross-chain swap service or a bridge, so that freezes cannot reach them. Some coins go into a mixer, which blends deposits so that withdrawals cannot be matched to them. Others go to an exchange or a swap desk.
How much of the stolen money is frozen?
$2.8 billion, at theft-time prices. Stablecoins make up 94% of it. Tether and Circle locked most of that, as USDT and USDC, within hours of the theft.
Run the next investigation in minutes
Ask any question of the blockchain. Bitquery's AI Investigations agent traces funds, attributes wallets, and writes auditable reports across every major chain. Prefer to do it yourself? Connect the Bitquery MCP server to your AI assistant, pull the raw datasets, or query the chain directly with the Bitquery API.